If I understand correctly, FREAK refers to a \"vulnerability\" in which, when a

Question

If I understand correctly, FREAK refers to a "vulnerability" in which, when a client offers weak cipher suites (usually export-grade cipher suites with 40 or 56 bit encryption) and a server can accept those cipher suites, a man-in-the-middle can perform a downgrade attack to use one of those weak cipher suites, and then break them (through brute-force or other weaknesses). But is this really a new attack method? I thought downgrade attacks and the possibility to use them in this manner was already known for quite a while (and this is why TLS_FALLBACK_SCSV was created). Did it just now pop into the mainstream? Did some researchers decide to give it a "brand" name and present it as a new vulnerability (since many clients/servers still offer/accept those cipher suites)? Or is there something else behind it that's not mentioned in the news? Also, I would think major, modern browsers would not be configured to offer those weak cipher suites, or at least wouldn't use them without big warnings like with invalid certificates. Did browser developers really make such an oversight?

Explanation / Answer

No. TLS_FALLBACK_SCSV was designed to prevent protocol degradation (from TLSv1 to SSLv3 for example), not cipher degradations.

To mitigate against cipher degradations, the server needs to stop offer export ciphers, or the client needs to stop accepting export ciphers.

TLS_FALLBACK_SCSV is designed to fix the vulnerability of downgrades in the protocol (regardless of cipher used), because SSLv3 and prior protocols, do have vulnerabilitys that can be used regardless of cipher.

Preventing export ciphers in a client is cumbersome, because the client must support any legacy ciphers aswell for backwards compatibility. But you could check in about:config if there is possibility to disable export ciphers.

If you however is running a server, its very possible to prevent the server from offering export ciphers at all, by reconfiguring it to never offer export ciphers in the SSL configuration. Then any cipher downgrade attacks cannot happen.

Note that you still need to support TLS_FALLBACK_SCSV, since a protocol downgrade can still break a "strong" cipher due to vulnerabilitys in the implementation.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.